Nulvless Documentation

How to put identity into your product — sign-in and permissions, framework quickstarts, the SDK reference, and the platform around them.

Introduction

nulvless is identity infrastructure for SaaS. It handles the parts of a product that every team ends up building and nobody wants to own: signing people in, deciding what they can reach, sending the messages those flows depend on, and keeping a record of what happened.

You integrate through one SDK. Everything else — providers, templates, roles, rate limits, environments — is configuration you change without shipping code.

Quickstart

Create a client and sign your first user in.

Fundamentals

Projects, environments, identities, grants and keys.

Build with an agent

Give this to your agent (Claude Code, Cursor, Codex) or chat before asking for code. It sends the agent to these docs and sets the rules it must not break.

Agent prompt

I'm building an app with nulvless (sign-in, sessions, MFA, permissions,
email/SMS) using the SDK `@nulvless/nulvless-js`.

Read the docs before writing code and use only what they describe. If
something isn't documented, tell me — never invent a method, option or
endpoint.

- Docs: https://www.nulvless.com/docs
- Every page: https://www.nulvless.com/llms.txt
- All of it in one file: https://www.nulvless.com/llms-full.txt
- Any page as Markdown: https://www.nulvless.com/llms.mdx/docs/<path>/content.md

Start with quickstart, api-keys, sdk, sdk/errors and
frameworks/<react|nextjs|vue|angular|html|node|express|fastify>.

Always:
- Keep the secret key (`sk-…`) and `createServerClient` in server code only.
  Never in client code, a `NEXT_PUBLIC_`/`VITE_` variable or the repository.
  Only the publishable key (`pk-…`) reaches the browser.
- Read keys and URLs from environment variables and list them in
  `.env.example` with placeholders.
- Check permissions on the server, not only in the UI.
- Never log or put in a URL a key, token or one-time code.
- Before writing code, ask which framework I use and whether it runs in the
  browser or on a server.

More prompts and a review checklist: Vibe coding.

Framework quickstarts

Each one ends with the same thing working: sign-up, sign-in, a second factor, and a route that redirects when the session ends.

React

Session survives reloads, routes redirect when it ends.

Next.js

Two clients, split so the secret key cannot reach the browser.

Vue

One composable every component shares, plus router guards.

Angular

Signals for the session, a guard, and a token interceptor.

HTML

One file from a CDN. No bundler, no framework, no build.

Node

The server-side model, before any framework wraps it.

Express

One middleware authenticates, another authorizes.

Fastify

A plugin decorates the request, hooks gate the route.

Reference

JavaScript SDK

@nulvless/nulvless-js — every client and method.

What is in the platform

Authentication — passwords, social providers, passwordless and multi-factor, with sessions that record device, location and the methods used to reach them.

Authorization — role-based access control where a role is granted on a resource and carries scopes, so the same person can hold different access in each place.

Sudo mode — a fresh confirmation in front of sensitive actions, including the ones your own product considers dangerous.

OAuth server — your project as a standards-compliant OAuth 2.1 and OpenID Connect issuer, so other applications can sign in with you.

Edge functions — your TypeScript running next to the identity data it reads, with the session already resolved on the request.

Communications — email and SMS templates per channel and per language, sent through your own providers.

Observability — monitoring and a queryable trail across every request the platform served.

About these docs

Guides and getting-started pages are available in English and Portuguese. Use the language switch in the sidebar. The SDK reference is kept in English only.